diff options
author | Daniel Henrique Barboza <danielhb413@gmail.com> | 2022-01-28 13:15:02 +0100 |
---|---|---|
committer | Cédric Le Goater <clg@kaod.org> | 2022-01-28 13:15:02 +0100 |
commit | 1977434bbfbdd97d28c2fea071ea00bf4ecd0079 (patch) | |
tree | 6f7bd3254d1edf9c2f97c6f89b9b4699c99488ba /target/ppc/helper_regs.c | |
parent | 0c0aac01c49cc159a37841b1954b1938f0582fb4 (diff) | |
download | qemu-1977434bbfbdd97d28c2fea071ea00bf4ecd0079.zip qemu-1977434bbfbdd97d28c2fea071ea00bf4ecd0079.tar.gz qemu-1977434bbfbdd97d28c2fea071ea00bf4ecd0079.tar.bz2 |
spapr.c: check bus != NULL in spapr_get_fw_dev_path()
spapr_get_fw_dev_path() is an impl of
FWPathProviderClass::get_dev_path(). This interface is used by
hw/core/qdev-fw.c via fw_path_provider_try_get_dev_path() in two
functions:
- static char *qdev_get_fw_dev_path_from_handler(), which is used only in
qdev_get_fw_dev_path_helper() and it's guarded by "if (dev &&
dev->parent_bus)";
- char *qdev_get_own_fw_dev_path_from_handler(), which is used in
softmmu/bootdevice.c in get_boot_device_path() like this:
if (dev) {
d = qdev_get_own_fw_dev_path_from_handler(dev->parent_bus, dev);
This means that, when called via softmmu/bootdevice.c, there's no check
of 'dev->parent_bus' being not NULL. The result is that the "BusState
*bus" arg of spapr_get_fw_dev_path() can potentially be NULL and if, at
the same time, "SCSIDevice *d" is not NULL, we'll hit this line:
void *spapr = CAST(void, bus->parent, "spapr-vscsi");
And we'll SIGINT because 'bus' is NULL and we're accessing bus->parent.
Adding a simple 'bus != NULL' check to guard the instances where we
access 'bus->parent' can avoid this altogether.
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220121213852.30243-1-danielhb413@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Diffstat (limited to 'target/ppc/helper_regs.c')
0 files changed, 0 insertions, 0 deletions